The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Telecommunications
Breach intelligence, attack campaigns, and threat reports targeting the Telecommunications sector.
Explore Other Sectors
Telecommunications Threat Reports
ESET Threat Report H1 2026: Unveiling PromptSpy, the First AI-Driven Android Malware
In February 2026, ESET researchers discovered PromptSpy, the first known Android malware to utilize generative AI during its execution. This malware leverages Google's Gemini AI to interpret on-screen elements dynamically, enabling it to adapt its behavior across various Android devices and maintain persistence by preventing uninstallation. PromptSpy is distributed through a malicious dropper disguised as a system update, primarily targeting Spanish-speaking users in South America, especially Argentina. Once installed, it abuses Accessibility Services to monitor and control the user interface, deploys a Virtual Network Computing (VNC) module for remote access, and captures sensitive data such as lockscreen credentials and screen activity. ([eset.com](https://www.eset.com/us/about/newsroom/research/eset-research-discovers-promptspy-first-android-threat-using-genai/%3Fsrsltid%3DAfmBOoqZ_0fHGAaMnVaEZ5B0AuPdwhhXlaecY3Klyk-8QVRG-fAAlTy6?utm_source=openai)) The emergence of PromptSpy signifies a pivotal shift in mobile cybersecurity, illustrating how threat actors are integrating generative AI to enhance malware adaptability and persistence. This development underscores the urgent need for advanced detection mechanisms and proactive security measures to counteract AI-driven threats in the evolving cyber landscape.
2 months ago
Kill Chain
AI's Breakthrough in Firmware Decryption: A Case Study
In 2026, Bishop Fox researchers utilized Anthropic's Claude, an advanced AI model, to autonomously reverse-engineer and decrypt SonicWall's proprietary firmware encryption. Without prior knowledge of the encryption format, Claude successfully traced the decryption logic, reconstructed the master key from embedded Shamir secret shares, and decrypted the firmware image. This achievement highlights the potential of AI in performing complex cybersecurity tasks traditionally requiring senior-level expertise. The experiment underscores the evolving role of AI in cybersecurity, demonstrating that AI models can independently execute sophisticated tasks such as firmware decryption. This advancement prompts a reevaluation of security strategies, emphasizing the need for continuous adaptation to AI capabilities in both offensive and defensive contexts.
2 months ago
Kill Chain
KDDI Data Breach 2026: Zero-Day Vulnerability Exploited
In June 2026, Japanese telecommunications giant KDDI detected unauthorized access to its email platform, affecting multiple internet service providers (ISPs) including STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE. The breach, initiated on May 16, exploited a zero-day vulnerability in third-party software, leading to the exposure of approximately 12.23 million email addresses and 7.61 million passwords. KDDI promptly blocked the attackers upon discovery on June 17 and implemented defensive measures to secure the compromised systems. This incident underscores the critical importance of securing third-party software components, as vulnerabilities in such software can serve as entry points for attackers. Organizations are urged to conduct thorough security assessments of third-party tools and implement robust monitoring systems to detect and respond to unauthorized access promptly.
2 months ago
Kill Chain
UAT-7810's Deployment of LONGLEASH Malware: A New Threat to Network Security
In July 2026, the Chinese advanced persistent threat (APT) group UAT-7810 enhanced its Operational Relay Box (ORB) network by deploying new malware variants, notably LONGLEASH, DOGLEASH, and JARLEASH. These tools target unpatched Ruckus wireless routers, exploiting vulnerabilities such as CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, to establish a robust infrastructure for subsequent cyber operations. The ORB network serves as a relay platform, facilitating attacks by other China-aligned threat actors, including UAT-5918, which has been implicated in cyber attacks against critical infrastructure in Taiwan since at least 2023. The development of these sophisticated malware tools underscores the evolving capabilities of UAT-7810 and the persistent threat posed to global network security. Organizations utilizing vulnerable networking devices are at heightened risk, emphasizing the need for proactive defense measures and timely patch management to mitigate potential intrusions.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Digi International's PortServer TS and Digi One SP IA Devices
In July 2026, Digi International disclosed two significant vulnerabilities affecting their PortServer TS and Digi One SP IA devices. The first, CVE-2026-12352, allows unauthenticated attackers to bypass authentication mechanisms, granting unauthorized access to restricted resources. The second, CVE-2026-12948, is a stored cross-site scripting (XSS) vulnerability that enables authenticated administrators to inject malicious scripts into system configuration fields, which execute in the browsers of users viewing the affected pages. These vulnerabilities pose risks of unauthorized access, credential theft, and potential system compromise. The disclosure of these vulnerabilities underscores the critical importance of securing networked devices, especially those integral to industrial control systems. Organizations must prioritize timely firmware updates and implement robust network segmentation to mitigate such risks. This incident highlights the ongoing challenges in maintaining the security of legacy systems and the necessity for continuous monitoring and proactive defense strategies.
2 months ago
Kill Chain
Spain Arrests Alleged Member of Pro-Russian Hacktivist Group in 2026
In March 2026, Spanish authorities arrested an alleged member of the pro-Russian hacktivist group Cyber Army of Russia Reborn (CARR) in Palencia, Spain. The arrest followed an investigation initiated by an FBI tip in August 2025. The individual is accused of providing logistical support to a Ukrainian hacker associated with CARR, facilitating their escape to Russia, and participating in cyber activities attributed to the pro-Russian hacktivist group NoName057(16). Authorities seized computers and cryptocurrency storage devices from the suspect's residence and froze a cryptocurrency wallet allegedly used for illicit payments. The suspect faces accusations of collaborating with a terrorist organization, glorifying terrorism, and damaging computers. ([cyberscoop.com](https://cyberscoop.com/spain-arrests-alleged-cyber-army-of-russia-reborn-member/?utm_source=openai)) This arrest underscores the ongoing international efforts to combat cyber threats posed by state-sponsored hacktivist groups targeting critical infrastructure. The collaboration between Spanish authorities and the FBI highlights the importance of cross-border cooperation in addressing cybercrime. Organizations are advised to remain vigilant against such threats and implement robust cybersecurity measures to protect their systems.
2 months ago
Kill Chain
Critical Backdoor in Tenda Router Firmware Exposes Networks to Unauthorized Access
In July 2026, a critical vulnerability (CVE-2026-11405) was discovered in multiple Tenda router firmware versions, revealing an undocumented authentication backdoor. This flaw allows attackers to gain administrative access to the device's web management interface without valid credentials, potentially compromising network security. The issue resides in the 'login()' function of the '/bin/httpd' web server binary, where, after standard MD5-based authentication fails, the firmware checks for an alternate password stored in the 'sys.rzadmin.password' configuration. If the supplied password matches this backdoor password, the device grants administrator access regardless of the username entered. Affected firmware versions include those for Tenda FH1201, W15E, AC10, AC5, and AC6 models. As of now, no patches have been released, and Tenda has not responded to communications from security researchers. Users are advised to disable the remote web management panel and restrict local network exposure to mitigate risks. This incident underscores the critical importance of thorough security audits in firmware development and the need for manufacturers to maintain open communication channels with the security community to address vulnerabilities promptly.
2 months ago
Kill Chain
Chinese Hackers Deploy LONGLEASH Malware to Expand ORB Network
In July 2026, the Chinese state-sponsored threat actor UAT-7810 expanded its Operational Relay Box (ORB) network by deploying the LONGLEASH malware. This campaign targeted unpatched Ruckus and ASUS AiCloud routers, exploiting known vulnerabilities such as CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492. The ORB network serves as a relay infrastructure for other China-aligned APTs, facilitating covert cyber-espionage operations. The introduction of LONGLEASH, an evolution of the previously documented SHORTLEASH backdoor, enhances the ORB network's capabilities, including reverse shell access, multiple proxying methods, and the ability to act as an intermediate C2 server. This development underscores the persistent and evolving nature of state-sponsored cyber threats targeting critical infrastructure. The emergence of LONGLEASH highlights a trend among nation-state actors to develop sophisticated malware that leverages existing vulnerabilities in widely used networking devices. This approach not only complicates attribution but also emphasizes the need for organizations to maintain rigorous patch management and network security practices to mitigate such threats.
2 months ago
Kill Chain
RedWing: The Rise of Telegram-Based Android Banking Malware
In July 2026, cybersecurity researchers identified 'RedWing,' a sophisticated Android malware-as-a-service (MaaS) operation distributed via Telegram. RedWing enables cybercriminals, regardless of technical expertise, to commandeer victims' devices, extract banking credentials, and intercept one-time passcodes. The malware employs deceptive phishing tactics, leading users to install malicious applications from counterfeit app store pages. Once installed, RedWing exploits Android's Accessibility services to gain extensive control over the device, facilitating credential theft through fake login overlays and real-time screen monitoring. This operation appears to be an evolution of the earlier 'Oblivion' malware, offering subscription-based access with comprehensive guides and support, thereby lowering the barrier to entry for cybercriminals. ([thehackernews.com](https://thehackernews.com/2026/07/redwing-maas-packages-android-bank.html?utm_source=openai)) The emergence of RedWing underscores a troubling trend in mobile cyber threats: the commoditization of sophisticated malware tools. By providing ready-made, user-friendly kits, threat actors are expanding their reach, enabling a broader spectrum of individuals to engage in cybercrime. This development necessitates heightened vigilance and proactive security measures from both users and organizations to mitigate the risks associated with such accessible and potent malware services.
2 months ago
Kill Chain
CERT/CC Uncovers Hidden Admin Backdoor in Tenda Router Firmware
In July 2026, the CERT Coordination Center (CERT/CC) disclosed a critical vulnerability (CVE-2026-11405) in Tenda router firmware, revealing an undocumented backdoor that allows attackers to bypass authentication and gain full administrative access to the device's web management interface. This backdoor is present in multiple firmware versions, including US_FH1201V1.0BR_V1.2.0.14(408)_EN_TD and US_AC6V2.0RTL_V15.03.06.51_multi_T, among others. Exploitation of this vulnerability could lead to unauthorized remote modifications, disabling of security features, or complete device takeover. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai)) The discovery underscores the persistent risks associated with undocumented backdoors in network devices, highlighting the need for rigorous security assessments and prompt firmware updates. Organizations are advised to disable remote management and change default LAN IP addresses to mitigate potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/07/certcc-warns-of-hidden-admin-backdoor.html?utm_source=openai))
2 months ago
Kill Chain
FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw
In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a 127-byte stack buffer overflow, leading to immediate kernel panics by overwriting stack canaries. The vulnerability arises from improper validation of the sockaddr length field, enabling attackers to craft malicious requests that exploit this weakness. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-3038/?utm_source=openai)) The discovery of CVE-2026-3038 underscores the persistent challenges in kernel security, particularly concerning input validation and memory management. This incident highlights the necessity for continuous vigilance and prompt patching to mitigate potential exploits that could lead to system crashes or privilege escalation.
2 months ago
Kill Chain
Google's Legal Action Against AI-Driven Phishing: A Case Study
In June 2026, Google filed a lawsuit against a China-based cybercrime network known as 'Outsider Enterprise.' This group utilized Google's Gemini AI to create and distribute phishing websites that impersonated entities like Google, YouTube, and government agencies such as New York's E-ZPass. Operating through Telegram, Outsider Enterprise offered phishing-as-a-service, providing nearly 300 scam templates to individuals lacking technical expertise. Over a two-week period, the group sent approximately 2.5 million fraudulent text messages to Android users, leading to significant financial losses among hundreds of thousands of victims. ([arstechnica.com](https://arstechnica.com/google/2026/06/google-sues-chinese-cybercrime-network-that-used-gemini-to-automate-scams/?utm_source=openai)) This incident underscores the escalating misuse of AI technologies in cybercrime, highlighting the urgent need for enhanced security measures and regulatory frameworks to combat AI-driven phishing schemes. The collaboration between Google, the FBI, and major U.S. carriers exemplifies a proactive approach to dismantling such operations and protecting consumers from sophisticated digital threats. ([techcrunch.com](https://techcrunch.com/2026/06/12/chinese-cybercrime-operation-that-used-ai-to-scam-hundreds-of-thousands-of-victims-sued-by-google/?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports